xbase-util 0.8.5__tar.gz → 0.8.6__tar.gz
Sign up to get free protection for your applications and to get access to all the features.
- {xbase_util-0.8.5 → xbase_util-0.8.6}/PKG-INFO +1 -1
- {xbase_util-0.8.5 → xbase_util-0.8.6}/setup.py +1 -1
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/pcap_util.py +7 -8
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/test.py +0 -6
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util.egg-info/PKG-INFO +1 -1
- {xbase_util-0.8.5 → xbase_util-0.8.6}/README.md +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/setup.cfg +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/__init__.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/add_column_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/common_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/dangerous_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/__init__.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/bean/ConfigBean.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/bean/CurrentConfigBean.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/bean/FlowBean.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/bean/TaskTemplateBean.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/bean/__init__.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/dao/ConfigDao.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/dao/CurrentConfigDao.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/dao/FlowDao.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/dao/TaskTemplateDao.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/dao/__init__.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/initsqlite3.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/es_db_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/esreq.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/geo_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/handle_features_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/packet_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/xbase_constant.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util.egg-info/SOURCES.txt +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util.egg-info/dependency_links.txt +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util.egg-info/not-zip-safe +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util.egg-info/top_level.txt +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util_assets/GeoLite2-City.mmdb +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util_assets/arkimeparse.js +0 -0
@@ -366,8 +366,8 @@ def reassemble_tcp_pcap(p):
|
|
366
366
|
info[key]['max'] = seq
|
367
367
|
packets2.append(packet)
|
368
368
|
if len(keys) == 1:
|
369
|
-
key = f"{
|
370
|
-
ack =
|
369
|
+
key = f"{packets2[0]['pkt'][IP].dst}:{packets2[0]['pkt'][IP].dport}"
|
370
|
+
ack = packets2[0]['pkt'][TCP].ack
|
371
371
|
info[key] = {
|
372
372
|
"min": ack,
|
373
373
|
"max": ack,
|
@@ -375,8 +375,7 @@ def reassemble_tcp_pcap(p):
|
|
375
375
|
"wrapack": False,
|
376
376
|
}
|
377
377
|
keys.append(key)
|
378
|
-
|
379
|
-
if len(packets) == 0:
|
378
|
+
if len(packets2) == 0:
|
380
379
|
return []
|
381
380
|
needwrap = False
|
382
381
|
if info[keys[0]] and info[keys[0]]['max'] - info[keys[0]]['min'] > 0x7fffffff:
|
@@ -388,13 +387,13 @@ def reassemble_tcp_pcap(p):
|
|
388
387
|
info[keys[0]]['wrapack'] = True
|
389
388
|
needwrap = True
|
390
389
|
if needwrap:
|
391
|
-
for packet in
|
390
|
+
for packet in packets2:
|
392
391
|
key = f"{packet['ip']['addr1']}:{packet['tcp']['sport']}"
|
393
392
|
if info[key]['wrapseq'] and packet['tcp']['seq'] < 0x7fffffff:
|
394
393
|
packet['tcp']['seq'] += 0xffffffff
|
395
394
|
if info[key]['wrapack'] and packet['tcp']['ack'] < 0x7fffffff:
|
396
395
|
packet['tcp']['ack'] += 0xffffffff
|
397
|
-
clientKey = f"{
|
396
|
+
clientKey = f"{packets2[0]['pkt'][IP].src}:{packets2[0]['pkt'][IP].sport}"
|
398
397
|
|
399
398
|
def compare_packets(a, b):
|
400
399
|
a_seq = a['pkt'][TCP].seq
|
@@ -413,14 +412,14 @@ def reassemble_tcp_pcap(p):
|
|
413
412
|
return (a_seq + len(a_data) - 1) - b_ack
|
414
413
|
return a_ack - (b_seq + len(b_data) - 1)
|
415
414
|
|
416
|
-
|
415
|
+
packets2.sort(key=cmp_to_key(compare_packets))
|
417
416
|
# del packets[num_packets:]
|
418
417
|
# Now divide up conversation
|
419
418
|
clientSeq = 0
|
420
419
|
hostSeq = 0
|
421
420
|
previous = 0
|
422
421
|
results = []
|
423
|
-
for i, item in enumerate(
|
422
|
+
for i, item in enumerate(packets2):
|
424
423
|
sip = item['pkt'][IP].src
|
425
424
|
sport = item['pkt'][IP].sport
|
426
425
|
seq = item['pkt'][TCP].seq
|
@@ -1,13 +1,7 @@
|
|
1
|
-
import re
|
2
|
-
from collections import Counter
|
3
|
-
|
4
|
-
import numpy as np
|
5
1
|
from scapy.packet import Raw
|
6
2
|
from scapy.utils import rdpcap
|
7
3
|
|
8
|
-
from xbase_util.common_util import get_res_status_code_list
|
9
4
|
from xbase_util.pcap_util import reassemble_tcp_pcap, reassemble_session_pcap
|
10
|
-
from xbase_util.xbase_constant import res_status_code_pattern
|
11
5
|
|
12
6
|
if __name__ == '__main__':
|
13
7
|
packets_scapy = reassemble_tcp_pcap(rdpcap("gzip2.pcap"))
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|